The VM-Series and Azure Application Gateway template
launches an Azure Application Gateway (Layer 7 load balancer) and
an Azure (Layer 4) load balancer. Nested between the Application
gateway and the load balancer are a pair of VM-Series firewalls
in an Availability Set, and a pair of sample web servers running
Apache2 on Ubuntu in another Availability Set. The Availability
Sets provide protection from planned and unplanned outages. The
following topology diagram shows the resources that the template
You can use a new or an existing storage account and resource
group in which to deploy all the resources for this solution within
an Azure location. It does not provide default values for the resource
group name and storage account name, you must enter a name for them.
While you can create a new or use an existing VNet, the template
creates a default VNet named vnet-FW with the CIDR
block 192.168.0.0/16, and allocates five subnets (192.168.1.0/24
- 192.168.5.0/24) for deploying the Azure Application Gateway, the
VM-Series firewalls, the Azure load balancer and the web servers.
Each VM-Series firewall is deployed with three network interfaces—ethernet0/1
in Mgmt subnet (192.168.0.0/24), ethernet1/1 in Untrust subnet (192.168.1.0/24),
and ethernet1/2 in the Trust subnet (192.168.2.0/24).
The template creates a Network Security Group (NSG) that allows
inbound traffic from any source IP address on ports 80,443, and
22. It also deploys the pair of VM-Series firewalls and the web
server pair in their respective Availability Sets to ensure that
at least one instance of each is available during a planned or unplanned maintenance
window. Each Availability Set is configured to use three fault domains and
five update domains.
The Azure Application Gateway acts as a reverse-proxy service,
which terminates a client connection and forwards the requests to
back-end web servers. The Azure Application Gateway is set up with
an HTTP listener and uses a default health probe to test that the
VM-Series firewall IP address (for ethernet1/1) is healthy and can receive
The template does not provide an auto-scaling solution;
you must plan your capacity needs and then deploy additional resources
to Adapt the Template for your deployment.
The VM-Series firewalls are not configured to receive and secure
web traffic destined to the web servers. Therefore, at a minimum,
you must configure the firewall with a static route to send traffic
from the VM-Series firewalls to the default router, configure destination
NAT policy to send traffic back to the IP address of the load balancer,
and configure Security policy rules. The NAT policy rule is also
required for the firewall to send responses back to the health probes
from the HTTP listener on the Azure Application Gateway. To assist
you with a basic firewall configuration, the GitHub repository includes
a sample configuration file called appgw-sample.xml that you
can use to get started.